Docker socket mounted into a service (ARCH10012)

Key config.compose.docker-socket · Severity error · Category security · CWE CWE-250

Whoever controls a container with the Docker socket can start containers on the host with any mount and any privilege - which is control of the host. Short and long volume syntax are both read.

Incorrect

services:
  ci-agent:
    image: example/ci-agent:1.8.0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

Correct

services:
  ci-agent:
    image: example/ci-agent:1.8.0
    volumes:
      - agent-work:/work
volumes:
  agent-work:

Fix

Do not mount the socket. When a tool really needs the Docker API, give it a restricted socket proxy that allows only the calls it uses, and keep that proxy off every network the tool’s users can reach.